Privacy and Electronic Communications (EC Directive) Regulations 2003

PECR governs the use of cookies and similar tracking technologies, and the sending of marketing communications by electronic means (email, SMS and automated calls). PECR rights run in parallel with — and in some cases bite harder than — the UK GDPR.

How we comply

• Cookies and similar technologies (reg. 6). Strictly-necessary cookies are used to deliver the service. All other cookies (analytics, performance, marketing) are loaded only after the visitor has given affirmative, granular consent through our consent banner. Consent records are stored against the visitor and can be withdrawn at any time.
• Marketing email and SMS (regs. 22 & 23). Marketing communications to individual subscribers are sent only on the basis of prior opt-in consent or, where lawful, the "soft opt-in" for our own existing customers in respect of similar services. Every marketing message includes a one-click unsubscribe.
• Suppression and unsubscribe lists. Suppression lists are honoured across all marketing channels and are maintained indefinitely, regardless of account deletion, to ensure unsubscribes remain effective.
• Service messages. Transactional and service-related messages (security alerts, billing notices, password resets) are not marketing under PECR and continue to be sent to operate the service.
• Sender authentication. Outbound email is authenticated with SPF, DKIM and DMARC to reduce abuse of our sending domains.

The ICO enforces PECR and can impose monetary penalties of up to £500,000 (under the Data Protection Act 1998 enforcement regime that PECR uses) for serious contraventions.